unveil: a single-file scanner for hidden prompt injection in repos and issues

Honest-Arachnid-1860 · reddit · 2026-09-06

Coding agents treat issue text, READMEs and comments as instructions, so attackers can hide directives in HTML comments, zero-width runs, bidi overrides or ANSI erase sequences — places human reviewers never look. This is no longer hypothetical: an August sweep of 529 open agent bounties found 73% were honeypots, and February's Cline compromise started from one issue title with zero-width and RTL-override characters.

The author built unveil, a single-file, zero-dependency Python scanner that flags: invisible codepoints (including decoded Unicode tag payloads), instructions hidden in comments/display:none, ANSI sequences overwriting visible text, prompt/secret exfiltration requests, and the honeypot signature — a visible disclaimer contradicted by hidden text. It supports -- and exit code 1 for CI.

A false-positive run against the READMEs of React, CPython, Rust, VS Code, Linux, Electrum, Node and Kubernetes (81 KB) produced zero highs and one medium: the Linux kernel README now contains benign machine-addressed text — scoring it precisely because nothing is concealed. The key insight: visible instructions to AI are normal now; concealment is the signal. Limitations stated up front: pattern-based, English rules, a detector not a sandbox. MIT-licensed.

Original post →

More from coding & agent

coding & agent channel →